Red Hat Build of Keycloak 26.4.10
Approved changes feed: RSS · Atom
cpe:2.3:a:redhat:build_of_keycloak:26.4.10:*:*:*:*:*:*:*
part: a version: 26.4.10 update: *
| Vendor | Redhat (e942785a-ca89-506e-bd99-50782639cde3) |
|---|---|
| Product | Build Of Keycloak (d6fb9030-f202-5ef5-8cdf-d5845602e058) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-3047 |
vulnerable | 2026-06-08 08:01:17.439368 |
Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login
HIGH (8.8)
A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.
Published: 2026-03-05T18:28:36.337Z
Updated: 2026-07-15T01:09:59.742Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3009 |
vulnerable | 2026-06-08 08:01:17.309761 |
Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)
HIGH (8.1)
A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control enforcement and may allow unauthorized authentication through a disabled external provider.
Published: 2026-03-05T18:27:43.294Z
Updated: 2026-07-15T01:10:09.461Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.